Back to Checks
github

Repository has package vulnerability scanning (Dependabot alerts) enabled

repository_dependency_scanning_enabled
Service: repositorySeverity: high
OfficialBuilt-inVerified
Categories:vulnerabilitiessoftware-supply-chain
Resource Type:NotDefined

GitHub repositories are assessed for dependency vulnerability scanning enabled via Dependabot alerts, which monitors the dependency graph for known vulnerable packages and versions.

Prowler logoProwlerprowler-provider-github

Risk

Without automated scanning, known vulnerable dependencies may persist unnoticed, enabling supply-chain compromise. Exploits in third-party libraries can drive RCE, data theft, or build tampering, undermining confidentiality, integrity, and availability across code and CI/CD.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler github --checks repository_dependency_scanning_enabled

Recommendation

Enable dependency vulnerability scanning with Dependabot alerts or an equivalent SCA tool across repositories. Apply defense in depth: keep manifests and lockfiles current, triage alerts quickly, use automated security updates with required reviews, and surface results in PR checks and notifications.

Remediation

CLI

gh api --method PUT repos/<OWNER>/<REPO>/vulnerability-alerts

Terraform

resource "github_repository" "<example_resource_name>" {
  name                 = "<example_resource_name>"
  vulnerability_alerts = true  # Enables Dependabot alerts to pass the check
}

Other

1In GitHub, open the target repository
2Click Settings > Code security and analysis
3Under Dependabot alerts, click Enable
4Verify the toggle shows Enabled

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGithub
from prowler.providers.github.services.repository.repository_client import (
    repository_client,
)


class repository_dependency_scanning_enabled(Check):
    """Check if package vulnerability scanning (Dependabot alerts) is enabled for dependencies in the repository

    This class verifies whether each repository has package vulnerability scanning enabled.
    """

    def execute(self) -> List[CheckReportGithub]:
        """Execute the Github Repository Package Vulnerabilities Scanner check

        Iterates over all repositories and checks if package vulnerability scanning is enabled.

        Returns:
            List[CheckReportGithub]: A list of reports for each repository
        """
        findings = []
        for repo in repository_client.repositories.values():
            if repo.dependabot_alerts_enabled is not None:
                report = CheckReportGithub(metadata=self.metadata(), resource=repo)
                if repo.dependabot_alerts_enabled:
                    report.status = "PASS"
                    report.status_extended = f"Repository {repo.name} has package vulnerability scanning (Dependabot alerts) enabled."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"Repository {repo.name} does not have package vulnerability scanning (Dependabot alerts) enabled."

                findings.append(report)

        return findings

References